REMARKS^ 

Claims 1-6, 8, 10-16, 18, 20-26, 28, and 30 are rejected under 35 USC 103(a) as 
unpatentable over Ramsey et al. (U.S. Patent No. 7,331,061) in view of Douglas (U.S. Patent No. 
6,269,400), and further in view of Cass. 

Claims 7, 9, 17, 19, 27 and 29 are rejected under 35 USC 103(a) as being unpatentable 
over Ramsey in view of Douglas in view of Cass as applied to claims 1,11, and 21 above and 
further in view of White et al. ("Anatomy of a Commercial- Grade Immune System, IBM 
Research White Paper, 1999"). 

Claims 1,2, 11, and 21 have been amended. 

Claim 10 has been canceled. 

Claims 1-9 and 11-30 are pending. 

Claims 1,11, and 21 of the present invention recite limitations that are neither taught nor 
suggested in the cited references. For instance, claims 1, 11, and 21 recite the virus sensor 
switching from a first mode to a second mode when the computer virus is detected. Although the 
Ramsey reference teaches a firewall, intrusion detection system, and virus scanner operable in a 
number of modes including an ignore mode and a monitor mode, Ramsey does not teach 
switching from a first mode to a second mode when the computer virus is detected. None of the 
other cited references teach this limitation. 

Claims 1,11, and 21 of the present invention also recite a controller using statistical 
results of observed abnormal events as recorded and monitored by a virus monitor. The 
abnormal events are defined in the plurality of detection rules. Ramsey does not teach a 
controller using statistical results of observed abnormal events. The Office Action equates virus 
signatures and intrusion detection signatures to statistical results of abnormal events. Applicant 
respectfully disagrees with this assertion. A signature is a unique value, such as a hash value, 
corresponding to the vims. While it may be arguable that virus signatures may be related to 
abnomial events since they are defined in the detection rules, virus signatures have no 
relationship with statistical results of observed abnormal events. The virus signatures are objects 
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used for detecting viruses. By contrast, the statistical results are the results from detecting 
viruses. 

Claims 1,11, and 21 of the present invention also recite the virus monitor generating an 
abnormal behavior report. Applicant respectfully submits that the generation of an abnormal 
behavior report is not disclosed in the cited references. 

Applicant has amended claims 1,11, and 21 to more clearly recite the limitations 
discussed above. Applicant has also amended claims 1, 1 1, and 21 to recite "a traffic controller 
coupled to the virus sensor and the network arranged to select certain data packets wherein the 
selected data packets or a copy of the selected data packets are forwarded to the virus sensor." 
Support for this may be found in paragraphs [0059] and [0060] of the specification. It is 
respectfully submitted that none of the cited references teach a traffic controller with those 
limitations. 

It is respectfully submitted that the claims are patentably distinct over the cited art of 
record. Additional limitations recited in the dependent claims are not further discussed because 
the limitations discussed above are sufficient to distinguish the claimed invention from the cited 
references. For at least these reasons, it is respectfully submitted that all pending claims are not 
obvious over the cited references. 

Applicant believes that all pending claims are allowable and respectfully requests a 
Notice of Allowance for this application from the Examiner. Should the Examiner believe that a 
telephone conference would expedite the prosecution of this application, the undersigned can be 
reached at the telephone number set out below. 



P.O. Box 1687 

Cupertino, CA 95015-1687 

(408) 255-8001 



Respectfully submitted, 
BEYER LAW GROUP LLP 

/Steven Chang/ 
Steven Chang 
Reg. No. 59,424 
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